All clients have a tailored solution to suit their individual needs and content of legitimate email. Cerberus is monitored 24 / 7 by the Cerberus IT Support Team

If an email score is very high, it is immediately rejected as spam and not delivered. If a mail has a marginal score it is tagged as spam (***SPAM***). Each user has a rule setup in their Email programme to filter all mail tagged to a specific folder. The user can then review the mail at their leisure, ensure that no false positives occur. All mail with low scores are delivered directly to the user.

 

False Information

Cerberus checks delivery headers for falsified information, non-existent domains or servers, and automatically generated mail. To cover their tracks, spammers will almost always falsify information such as email address, the sending server’s IP, and server handshake messages.

Spam often comes from a well-known domain, such as yahoo.com, aol.com etc. Cerberus knows what a connection from such servers looks like, and if the connection is false, will detect it.

Cerberus Database

Cerberus maintains it’s own automatically updated Bayesian database of keywords and other key information about previously received mail that has scored highly against other rules. Any new spam that matches enough of the keywords is given points. The database also keeps a record of non-spam, and actually reduces the score on mail that doesn’t match its database. The database updates in real-time, upon receipt of every single mail it filters.

In a very real sense Cerberus is constantly learning and adapting to combat new threats and methods used by spammers.....we call this this ‘Intelligent Growth’

Known Spam Elements

Spam is often entirely or partially randomly generated to avoid -spam systems that check for previous duplicates (all the nonsense words often seen at the bottom of spam). Unfortunately for the spammer, email generated by software looks very different in the transmission headers to ordinary mail sent from a user in Outlook etc. Cerberus can detect these differences and spot that a human didn’t send the mail.

The Razor -Spam Database

The Razor -spam database is a remotely maintained database of known spam. Every message that passes through Cerberus is checked against it. If the spam has been seen before by any one of thousands of users that regularly submit spam, it will match and get points. Cerberus sends updates to the Razor database whenever a spam message gets over a fixed number of points, so we are also contributing.

Spam Lists

Cerberus has a regularly updated list of URLs, Telephone numbers and street addresses that often appear in spam messages (“call 1-800-555-2345!”), and will reject mail that includes them.

Blacklists

Every message is checked against nine DNS and Relay blacklists. Each match will give a few points towards the score of a potential spam – several matches, or one match and points from other checking techniques will label the mail as spam. This reduces overblocking, since many servers listed on the blacklists are innocent, having been used in the past to relay spam without the knowledge of the owners.

Key Words

Language is tested for obfuscations and particular words or strings of words. “V*I*A*G*R*A” or “v1agr4” and other such possibilities are recognised, and will actually score the mail higher than if just the plain word “Viagra” is present. Words that appear in most spam, like “mortgage”, “enlargement” and “medication” are checked in similar ways with every possible combination of letters, numbers and symbols that could be used to make the word look right but normally avoid scanners. Higher points for obfuscated words means that genuine mail that happens to mention one of these subjects is less likely to be tagged as spam.

One of the advantages of Cerberus over Spam applications is that it can be tailored to ‘not block’ common spam words like ‘medication’ or ‘drug’ if this is attractive

Style

The style of the email is checked too – a large amount of images or HTML, coloured fonts, large gaps in content, excessive exclamation marks etc. are spotted and scored.

Smaller Checks

There are many other small checks, too many to list in detail. Checks on sender addresses – such as the use of a Polish (.pl) domain, or numbers in the username (before the @) – will add a few points each. Invalid email addresses, no sender address, blank subjects, many CC recipients, long spaces in subject, foreign language (such as Korean) text are examples.

Intelligent Growth

With enough points, the email is tagged, a certain amount more, the email is blocked entirely. Somewhere in between, the email has enough points to be reported to the Razor database. The amount of points (no matter how many) is also used to update the Bayesian database with keywords that denote future matches as spam or not spam.